What is this Notice?
This Notice applies to people who:
- make enquiries with BU or attend BU student recruitment events with a view to possibly making an application to study at BU; and
- apply to study at BU
before the point at which they accept an offer of a place at BU.
As a result of your engagement with BU, we will hold your “personal data”, i.e. information in a form that identifies you as individual [often referred to as “data” in this Notice]. This Notice explains how we use and protect your data.
In this Notice, “BU” "we", "our" and "us" refers to Bournemouth University Higher Education Corporation. We have separate Privacy Notices covering information relating to BU Students, BU Alumni, BU Staff, people participating in BU research projects and people making enquiries or attending general public engagement events at or connected to BU.
The purpose of this Notice is to enable you to understand the scope of the personal data which BU holds and uses that relates to you personally, and how this data will be handled by us. It covers use of your information within BU and the circumstances in which we will share your data with other organisations.
We think it is important that you can understand how and why we use your data. We are also legally required to give you specific information about the processing of your data.
For this reason, and because BU is a large organisation which needs to collect and use personal data for a range of purposes, this Notice is quite long, and it contains some technical legal language. We have tried to make the Notice as clear as possible and provide signposting so that you can find the information most relevant to you. See section (c) below for guidance on how to use the Notice.
What is data protection?
Personal data is information relating to identifiable living individuals (known as “data subjects”). Use of personal data (including collecting data, sharing data or just holding it in files) is referred to as “data processing”. To protect your interests and rights, organisations do not have complete freedom in how they use your personal data. They have to comply with data protection laws, which apply restrictions on when and how personal data can be processed. Processing of personal data is lawful only if it meets certain requirements or conditions. These are concerned with the purpose of the processing and how it is carried out.
Our data protection laws are set out in the EU General Data Protection Regulation (called “GDPR”) and the UK Data Protection Act 2018.
Under these laws, BU is the data controller of the information it collects and processes as described in this Notice. This means that it has the core legal responsibility to safeguard the information and ensure it is processed lawfully.
In particular BU must:
- Take steps to ensure that the data it processes is accurate and up to date;
- Give you clear information about its processing of your data, in one or more Privacy Notices like this one;
- Only process your data for specific purposes described to you in a Privacy Notice, and only share your data with third parties as provided for in a Privacy Notice;
- Keep your data secure; and
- Respond within set timescales to certain enquiries or requests from individuals about the use of their data.
Information about your data protection rights as a data subject is set out later in section 7 of this Notice.
Using this Notice
Sections 4 and 5 of this Notice identify and explain the data processing and data sharing carried out by BU.
In these sections, against each description of a data processing or sharing activity you will automatically see a summary description of the processing and a colour-coded indicator of the legal basis of the processing (these are explained below). This first level of information will also include any specific processing activities which we particularly need to highlight to you. You can then choose whether to click through to see a more detailed layer of information about the processing and its legal basis.
Understanding the legal basis for processing of your data
BU is using colour coding to provide a quick, easily-accessible indication of the legal basis for processing. This section explains how the colour coding in this Notice links to conditions set out in the GDPR: references to Articles are to the relevant provisions within the GDPR. The conditions listed here are those which BU is relying on in relation to the processing covered by this Notice and may not be a complete list of all available conditions under the data protection legislation. Further information about the basis of a specific category of processing can always be obtained by clicking through the links in section 4 of this Notice.
More information: Conditions of processing for any personal data
- Necessary for the performance of a contract between you and BU: this will be either the core contract between us, the BU student agreement, [relating to any offer of a place to study at BU] or an additional contract for other services. The terms of the BU Student Agreement can be found here. [Art 6.1(b)]
- Necessary for compliance with a legal obligation on BU: we will identify the relevant obligation [Art 6.1(c)]
- Necessary to protect your vital interests or those of another person, i.e. to prevent or manage significant risks of harm [Art 6.1(d)]
- Necessary for the performance of a task carried out in the public interest: this would usually be an activity within BU’s core purpose as a statutory higher education corporation, to deliver higher education and carry out research, but might refer to a public interest task pursued by another organisation [Art 6.1(e)]
- Consent: this means that you have agreed that we can use your data for this specific purpose. You are able to withdraw your consent at any time. When you are asked for consent, you will also be given details of who to contact to withdraw your consent.
- Necessary for legitimate interests pursued by BU or another organisation, where BU has determined that the processing represents an appropriate balance between its aims and your interests, rights and freedoms as a data subject. Where this applies, we will identify the purpose we are pursuing. [Art 6.1(f)]
More information: Additional conditions of processing for special category data
One of these must apply if we are processing any information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health or disability or your sex life or sexual orientation. These are referred to as “special categories” of data in the data protection legislation.
- Explicit consent: this means that you have explicitly agreed that we can use your personal data for this specific purpose. You are able to withdraw your consent at any time. When you are asked for consent, you will also be given details of who to contact to withdraw your consent. [Art 9.2(a)]
- Necessary for the purposes of substantial public interest. Where this applies, we will identify the relevant public interest [Art 9.2(g)]
- Necessary for research or statistical purposes, where it is considered that that the use of your data will be proportionate to the aims of the research and that your interests as a data subject will be appropriately safeguarded [Art 9.2(j)]
In addition, we can only process information about any criminal convictions you may have where this is in the substantial public interest and falls within a relevant description of processing set out in Schedule 1 of the Data Protection Act 2018. Further information about the basis on which we process this information is set out later in this Notice.